VulnHub

Researchers have uncovered a new form of spyware called AdFection that infiltrates victims' devices through targeted advertising. This method allows attackers to deliver malicious software by embedding it within ads that users might click on, effectively bypassing traditional security measures. The implications of these attacks extend beyond individual users, as they pose significant risks to the online advertising ecosystem and raise concerns for regulators trying to manage digital advertising safety. Users are at risk of having their personal information compromised, while companies may face reputational damage and potential legal consequences. As these tactics evolve, both users and advertisers need to be vigilant about the ads they engage with online.

A credential-theft campaign named GhostAction has recently intensified, affecting around 1,900 GitHub accounts. This attack, observed by GitGuardian on October 8 and 9, 2026, targeted over 30,000 repositories linked to approximately 3,000 users and organizations. The attackers aimed to extract sensitive information, specifically 3,174 secrets from public repositories' Continuous Integration (CI) systems. This incident raises significant concerns for developers and organizations using GitHub, as compromised accounts can lead to unauthorized access and potential data breaches. Users are advised to secure their accounts and monitor their repositories for any suspicious activity.

In April 2025, the UK's Legal Aid Agency (LAA) experienced a significant data breach where hackers accessed and stole sensitive records dating as far back as 1978. This breach is concerning as it compromises the personal and legal information of individuals who relied on the Public Defender Service over decades. The stolen records may include sensitive data that could be used for identity theft or fraud. The LAA, which operates under the Ministry of Justice, is now facing scrutiny over its cybersecurity measures and the potential risks to the public. This incident underlines the importance of robust security practices, especially for agencies handling sensitive information.

A serious security vulnerability has been identified in Langflow, an open-source platform for developing AI applications. This flaw, tracked as CVE-2026-105740, has a high severity rating of 9.9, indicating it poses a significant risk to users. According to a report by Previdian, attackers have already made 1,423 attempts to exploit this vulnerability in honeypot systems. The flaw allows for authenticated remote code execution, which means that if successfully exploited, attackers could run arbitrary code on affected systems. Given Langflow’s use in various AI projects, this vulnerability could have wide-ranging implications for developers and organizations relying on the platform. Users should prioritize patching and securing their installations to mitigate potential attacks.

A number of grocery stores across the European Union faced significant financial losses due to outdated firmware in their cooling systems. These stores had outsourced management of their operational technology (OT) to third-party vendors, who failed to update the firmware, leaving the systems vulnerable. As a result, hundreds of stores reported losses amounting to millions of dollars. This incident serves as a stark reminder of the risks associated with neglecting firmware updates, especially in critical systems like refrigeration that directly impact food safety and inventory management. Companies must prioritize regular updates and maintenance to avoid similar costly failures in the future.

Palo Alto Networks has patched a zero-day vulnerability in its PAN-OS that could allow remote code execution. The company has confirmed that there has been limited exploitation of this flaw against its customers' firewalls. To assist in identifying compromised systems, Palo Alto Networks has made indicators of compromise (IoCs) available to users. This vulnerability poses a significant risk as it can be exploited by attackers to gain unauthorized access to critical network infrastructure. Organizations using affected firewalls should prioritize applying the latest updates to mitigate potential threats.

Ahsay Backup, based in Singapore, has released security updates to fix two vulnerabilities in their AhsayCBS software, identified as CVE-2026-105133 and CVE-2026-105134. These flaws have been exploited by attackers to install web shells and XMRig cryptocurrency miners on compromised systems. The vulnerabilities allow unauthorized access and execution of arbitrary commands, making them particularly dangerous. Users of AhsayCBS should apply the latest patches immediately to protect their systems from these exploits, which have already been seen in the wild. The situation underscores the need for continuous monitoring and updating of software to defend against evolving threats.

Palo Alto Networks has identified a serious vulnerability in its PAN-OS, labeled CVE-2026-0322, which allows for remote code execution (RCE). This flaw is particularly concerning as it has already been exploited in attacks focusing on their firewall products. Users of Palo Alto's firewalls are at risk, as attackers can potentially gain unauthorized access and control over affected systems. To address this issue, Palo Alto Networks has issued security updates, urging users to apply them promptly to safeguard their networks. This incident highlights the ongoing challenges organizations face in securing their infrastructure against emerging cyber threats.

A cybercrime operation known as Yam Store has been discovered to be behind the distribution of over 1 billion phishing messages globally. This network provided the necessary cloud infrastructure and phishing kits that enabled attackers to target individuals and organizations alike. The scale of this operation raises significant concerns about the effectiveness of existing cybersecurity measures, as it demonstrates how easily malicious actors can exploit readily available tools to launch widespread attacks. Users and companies need to be particularly vigilant and adopt stronger security practices to protect against these phishing attempts. The findings serve as a stark reminder of the ongoing battle between cybercriminals and those trying to secure digital spaces.

A vulnerability has been discovered in the preview pane of Claude Code Desktop, which could allow attackers to steal sensitive credentials from developers without any interaction required. This zero-click flaw poses a significant risk as it can extract SSH private keys, AWS credentials, and Claude OAuth tokens quietly. Developers using this software may unknowingly expose their credentials, leading to potential unauthorized access to their systems and services. This incident raises concerns about the security of development tools and the need for heightened vigilance among users. It's crucial for developers to stay informed about this vulnerability and take necessary precautions to protect their sensitive information.